---
title: "CVSS"
canonical: https://trickest.com/glossary/cvss
description: "CVSS produces a numeric score from 0 to 10 that rates the severity of a vulnerability based on factors like attack vector, complexity, and impact, helping teams compare and prioritize fixes."
---

# CVSS

The Common Vulnerability Scoring System rates a flaw on a 0 to 10 scale derived from base metrics like attack vector, attack complexity, privileges required, user interaction, and the confidentiality, integrity, and availability impact. The Base score captures intrinsic severity, while optional Temporal and Environmental metrics adjust for exploit maturity and how the flaw matters in a specific deployment. CVSS 4.0 refined the model, but most feeds still carry 3.1 vectors.

The score gives teams a common language to compare unrelated vulnerabilities and to set patch deadlines, which is why it appears alongside nearly every [CVE](/glossary/cve) and in the output of most [vulnerability scanning](/glossary/vulnerability-scanning) tools.

Treat CVSS as a starting point, not a verdict. A 9.8 on an unreachable internal host can matter less than a 6.5 on an internet-facing login page, and a high base score means little until someone confirms a working [exploit](/glossary/exploit) exists. Penetration testers weigh CVSS against real reachability and business context during a [penetration testing](/glossary/penetration-testing) engagement.

In a Trickest workflow you enrich scanner findings with CVSS vectors automatically, then filter and route the highest-severity reachable issues into alerts so triage starts with what carries the most risk.

---
_Markdown source of https://trickest.com/glossary/cvss._